Networking & DNS
Bug Report
Default-deny NetworkPolicy shipped, every service lost DNS: allowing egress to kube-dns
We rolled out a default-deny egress NetworkPolicy to a namespace and every pod immediately failed to resolve names, including other services in the same namespace. Policies select pods, DNS runs in kube-system, and the namespace selector needed the right label. The policy set we use now and how we test it.